KeyRotate
Rotate keys, switch accounts
Only for Mac
Free · In‑App Purchases
Mac
KeyRotate keeps your API keys and AI subscriptions safe — watches for the signs that one has leaked, and replaces it when it needs replacing.
From the developers of FrontierStack and PowerWatch.
Why? This developer had his AI API keys hijacked and was billed $10K in 24 hours despite having a $400 cap on his account! I don't want anyone else to suffer that.
Every key lives in the macOS Keychain, behind Touch ID. Nothing is stored in a file that could leak, nothing syncs to a server, and there is no account to create.
Rotate on demand. Schedule automatic rotates. Rotate often. Rotate for safety. Rotates made easy. Rotate is your friend.
GUARD: AN ALARM BELL FOR LEAKED KEYS
One screen for every sign that a key may be in someone else's hands, worst first, each with one action: Rotate now, Open key or Dismiss.
- AI tool logs: a key pasted into Claude Code, Codex, Gemini CLI or another coding agent went to the AI provider and sits in its logs. KeyRotate reads them hourly and rings when one of yours is there.
- Repositories: every branch and tag of your GitHub, Gitea, GitLab and Bitbucket repositories, plus GitHub's own secret-scanning alerts.
- Web projects: a .env, backup or script your web server would hand to anyone.
- Leaked email: SMTP and mail-API passwords, addresses your site exposes, and your addresses in new Have I Been Pwned breaches.
- Breach advisories: Enfour's signed notices, ranked by the keys and accounts you hold.
- A key the vendor suddenly refuses, a whole account that may be disabled, expiry countdowns and rate limits.
Push alerts reach you even with KeyRotate closed, including one if Guard itself stops.
ROTATE, PROPERLY
Where vendors let you we mint replacements. KeyRotate asks for a new key, verifies it works BEFORE saving it, saves it, verifies again — and puts the old one back if anything fails. The previous key is never revoked automatically, so a rotation can't take down a cron job or a server you forgot about; KeyRotate reminds you once every file and server has confirmed the new one.
UPDATE EVERYWHERE IT IS USED
Tell KeyRotate which files use a key — .env, PHP config, JSON (including Claude Code's settings.json), YAML and TOML, or your own pattern — and after any rotation it updates only what you confirm. Writes are atomic, keep permissions, and leave a one-click backup. KeyRotate matches your variable by name and replaces that line; it reads nothing else. A target can also be a file on a server, over SSH, with a sync job that retries any box that was down.
TOKEN MAXING
A plan's usage window starts with your first message and ends a fixed time later, used or not. KeyRotate sends one tiny message to each account the moment its window ends, and staggers your accounts so a fresh window comes up at a steady interval.
ROUND-ROBIN YOUR ACCOUNTS
Two Claude Max seats, or a work and a personal ChatGPT plan? KeyRotate switches between them — by hand, from the menu bar, or automatically as each allowance runs out. A key pool cycles API keys under one account when the vendor rate-limits or rejects one.
TAKE PAYMENTS
All the major card and payment systems, with each provider's requirements shown before you start, so a rotation never takes a storefront down at the till.
SEE IT ALL AT ONCE
What needs attention, which accounts are in use and how full, and what it costs this month — plan seats and API spend added up per currency.
WORKS WITH YOUR TOOLS
Claude Code and Codex profiles per account, OpenClaw and other agent runtimes, VibeProxy, and FrontierStack, which receives every new key over a pinned, signed local connection.
PRIVATE BY DESIGN
No account, no telemetry. KeyRotate talks to the vendors whose keys you asked it to check, the git hosts you add, Have I Been Pwned for the addresses you list, and — only if you turn on push alerts or pair an iPhone — Enfour's relay, which never sees your keys or the services you use. Access to files is granted by you, folder by folder.
Ratings & Reviews
- This app hasn’t received enough ratings or reviews to display an overview.
KeyRotate now guards your keys, not just rotates them.
NEW: GUARD
One screen for every sign that a key may be in someone else's hands, worst first, each with one thing to do: Rotate now, Open key or Dismiss. A sidebar badge counts the warnings, and closing the window keeps KeyRotate watching from the menu bar.
• AI tool logs — a key pasted into Claude Code, Codex, Gemini CLI, Qwen Code, OpenCode, Goose, Cline or Roo Code, or printed by a command it ran, went to the AI provider and sits in plain text in the tool's logs. KeyRotate reads new log lines every hour and rings when one of your keys is there.
• Repositories — add a GitHub, Gitea, Forgejo, GitLab or Bitbucket account, or any HTTPS git address. KeyRotate copies each repository's full history to your Mac with git built in, searches every branch and tag, and reads GitHub's own secret-scanning alerts.
• Web projects — findings are judged by what your web server would hand out: a .env file or backup in the web root, a key in a script sent to browsers. Pancake Stack and FrontierStack can send a site to KeyRotate with Watch in KeyRotate….
• Forgotten .env files — every scan lists the .env files a rotation would miss, and offers to import their keys, make them targets or update old copies.
• Leaked email — SMTP and IMAP passwords, mail server addresses with a password in them, and SendGrid, Mailgun, Brevo, Postmark and Resend keys are caught like API keys. Web projects list the email addresses a site hands out. Add your addresses and a Have I Been Pwned key, and KeyRotate checks them daily for new breaches.
• Disabled accounts — when every key for a vendor account stops working at once, Guard says the account may be disabled, so you check your email before replacing keys that would not help.
BREACH ADVISORIES THAT KNOW WHAT YOU USE
Enfour's signed breach advisories are now ranked on your Mac by the keys and accounts you hold — exposed, likely, possible or unlikely — so the breaches that concern you come first. Nothing about what you use leaves your Mac.
ALERTS WHILE KEYROTATE IS CLOSED
Turn on Apple push for new breach advisories, and for a warning if Guard stops — KeyRotate quit, hung or crashed.
ALSO
• Re-scans run daily, and checks continue in the background between them.
• More keys sync: GoDaddy, SwitchBot, Have I Been Pwned and Paddle's client token.
The developer, Enfour, Inc., indicated that the app’s privacy practices may include handling of data as described below. For more information, see the developer’s privacy policy .
Data Not Collected
The developer does not collect any data from this app.
Accessibility
The developer has not yet indicated which accessibility features this app supports. Learn More
Information
- Seller
- Enfour, Inc.
- Size
- 21.9 MB
- Category
- Developer Tools
- Compatibility
Requires macOS 14.0 or later.
- Mac
Requires macOS 14.0 or later.
- Mac
- Languages
English and 2 more
- English, Japanese, Korean
- Age Rating
4+
- 4+
- In-App Purchases
Yes
- KeyRotate Monthly $1.99
- Copyright
- © Enfour, Inc. 2026